Jonathan Katz
b99e5564e9
### Summary: Generates a json schema for valid GitOps yaml files, to be used with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server) for IDE integration. This PR includes the actual generated file, so it can be used without running the tool. All files are in `/tools/gitops-autto-complete`, so nothing else gets affected. #### What it adds: - Complete json schema that defines valid GitOps yaml files and can be integrated with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server). - Auto-completion, error checking, type checking, descriptions. - Defines all keys for osquery options/flags (based on `server/fleet/agent_options_generated.go`). - Additional validation: required keys, strings that must be enclosed in quotation marks, path support. - Additional data: descriptions from code comments, notices for fields that don't reset if null or empty. #### Limitations: - Some structs and data are duplicated into the tool and will inevitebly mismatch over time, because the structs used for gitops are not sufficient for the schema generation: - Some fields use an interface/any type that so can't be used for the schema generation. - Some important details are not encoded in the type or struct tags for gitops fields at all. - Some details (like required fields) are encoded in the Validate() interface, but the IDE integration cannot run Go code. - Doesn't work with all yaml file types used for gitops (like a yaml file that specifies multiple software packages), only the default/fleet level files. This will require having a subsection of the schema for each type of file, and some way to detect what it actually is (maybe specifying the schema in the file itself). - Requires manual setup to integrate with IDE, it's not an easy to use extension currently. #### Dependencies: - `invopop/jsonschema` reflects Fleet's GitOps structs into the schema. - `santhosh-tekuri/jsonschema/v6` validates the test fixtures against that schema. - `ghodss/yaml` decodes the fixture YAML the way fleetctl does. https://github.com/user-attachments/assets/b6ffacd0-e602-41a2-b46a-7d10300c6ea5 ## Testing - [x] QA'd all new/changed functionality manually - I have been using and working on this for the past week so it's in a pretty good state, but some descriptions or keys are probably still missing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added GitOps YAML auto-completion powered by a comprehensive JSON Schema. * Added validation for GitOps configuration structure, supported fields, data types, required combinations, and unknown keys. * Added support for external file references using `path` and `paths` in supported sections. * Added clearer guidance for deprecated fields and special field behaviors. * **Bug Fixes** * Improved detection of incorrectly typed values and invalid configuration shapes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
221 lines
6.2 KiB
YAML
221 lines
6.2 KiB
YAML
# Test config
|
|
labels:
|
|
- name: a
|
|
description: A cool global label
|
|
query: SELECT 1 FROM osquery_info
|
|
label_membership_type: dynamic
|
|
- name: b
|
|
description: A fresh global label
|
|
label_membership_type: manual
|
|
hosts:
|
|
- host1
|
|
- host2
|
|
- name: d
|
|
description: A manual label without hosts key
|
|
label_membership_type: manual
|
|
controls: # Controls added to "No team"
|
|
apple_settings:
|
|
configuration_profiles:
|
|
- path: ./lib/macos-password.mobileconfig
|
|
windows_settings:
|
|
configuration_profiles:
|
|
- path: ./lib/windows-screenlock.xml
|
|
scripts:
|
|
- path: ./lib/collect-fleetd-logs.sh
|
|
enable_disk_encryption: false
|
|
windows_require_bitlocker_pin: false
|
|
macos_migration:
|
|
enable: false
|
|
mode: ""
|
|
webhook_url: ""
|
|
setup_experience:
|
|
macos_bootstrap_package: null
|
|
enable_end_user_authentication: false
|
|
apple_setup_assistant: null
|
|
macos_updates:
|
|
deadline: null
|
|
minimum_version: null
|
|
ios_updates:
|
|
deadline: null
|
|
minimum_version: null
|
|
ipados_updates:
|
|
deadline: null
|
|
minimum_version: null
|
|
windows_enabled_and_configured: true
|
|
windows_updates:
|
|
deadline_days: null
|
|
grace_period_days: null
|
|
reports:
|
|
- name: Scheduled query stats
|
|
description: Collect osquery performance stats directly from osquery
|
|
query: SELECT *,
|
|
(SELECT value from osquery_flags where name = 'pack_delimiter') AS delimiter
|
|
FROM osquery_schedule;
|
|
interval: 0
|
|
platform: darwin,linux,windows
|
|
min_osquery_version: all
|
|
observer_can_run: false
|
|
automations_enabled: false
|
|
logging: snapshot
|
|
labels_include_any:
|
|
- a
|
|
- b
|
|
- name: orbit_info
|
|
query: SELECT * from orbit_info;
|
|
interval: 0
|
|
platform: darwin,linux,windows
|
|
min_osquery_version: all
|
|
observer_can_run: false
|
|
automations_enabled: true
|
|
logging: snapshot
|
|
- name: osquery_info
|
|
query: SELECT * from osquery_info;
|
|
interval: 604800 # 1 week
|
|
platform: darwin,linux,windows,chrome
|
|
min_osquery_version: all
|
|
observer_can_run: false
|
|
automations_enabled: true
|
|
logging: snapshot
|
|
policies:
|
|
- name: 😊 Failing policy
|
|
platform: linux
|
|
description: This policy should always fail.
|
|
resolution: There is no resolution for this policy.
|
|
query: SELECT 1 FROM osquery_info WHERE start_time < 0;
|
|
labels_include_any:
|
|
- a
|
|
- name: Passing policy
|
|
platform: linux,windows,darwin,chrome
|
|
description: This policy should always pass.
|
|
resolution: There is no resolution for this policy.
|
|
query: SELECT 1;
|
|
labels_exclude_any:
|
|
- b
|
|
- name: No root logins (macOS, Linux)
|
|
platform: linux,darwin
|
|
query: SELECT 1 WHERE NOT EXISTS (SELECT * FROM last
|
|
WHERE username = "root"
|
|
AND time > (( SELECT unix_time FROM time ) - 3600 ))
|
|
critical: true
|
|
- name: 🔥 Failing policy
|
|
platform: linux
|
|
description: This policy should always fail.
|
|
resolution: There is no resolution for this policy.
|
|
query: SELECT 1 FROM osquery_info WHERE start_time < 0;
|
|
- name: 😊😊 Failing policy
|
|
platform: linux
|
|
description: This policy should always fail.
|
|
resolution: There is no resolution for this policy.
|
|
query: SELECT 1 FROM osquery_info WHERE start_time < 0;
|
|
agent_options:
|
|
command_line_flags:
|
|
distributed_denylist_duration: 0
|
|
config:
|
|
decorators:
|
|
load:
|
|
- SELECT uuid AS host_uuid FROM system_info;
|
|
- SELECT hostname AS hostname FROM system_info;
|
|
options:
|
|
disable_distributed: false
|
|
distributed_interval: 10
|
|
distributed_plugin: tls
|
|
distributed_tls_max_attempts: 3
|
|
logger_tls_endpoint: /api/v1/osquery/log
|
|
pack_delimiter: /
|
|
org_settings:
|
|
server_settings:
|
|
debug_host_ids:
|
|
- 10728
|
|
deferred_save_host: false
|
|
enable_analytics: true
|
|
live_reporting_disabled: false
|
|
report_cap: 2000
|
|
discard_reports_data: false
|
|
scripts_disabled: false
|
|
server_url: $FLEET_SERVER_URL
|
|
ai_features_disabled: true
|
|
org_info:
|
|
contact_url: https://fleetdm.com/company/contact
|
|
org_logo_url: ""
|
|
org_logo_url_light_background: ""
|
|
org_name: $ORG_NAME
|
|
smtp_settings:
|
|
authentication_method: authmethod_plain
|
|
authentication_type: authtype_username_password
|
|
configured: false
|
|
domain: ""
|
|
enable_smtp: false
|
|
enable_ssl_tls: true
|
|
enable_start_tls: true
|
|
password: ""
|
|
port: 587
|
|
sender_address: ""
|
|
server: ""
|
|
user_name: ""
|
|
verify_ssl_certs: true
|
|
sso_settings:
|
|
enable_jit_provisioning: false
|
|
enable_jit_role_sync: false
|
|
enable_sso: true
|
|
enable_sso_idp_login: false
|
|
entity_id: https://saml.example.com/entityid
|
|
idp_image_url: ""
|
|
idp_name: MockSAML
|
|
issuer_uri: ""
|
|
metadata: ""
|
|
metadata_url: https://mocksaml.com/api/saml/metadata
|
|
integrations:
|
|
jira: []
|
|
zendesk: []
|
|
google_calendar:
|
|
- domain: example.com
|
|
mdm:
|
|
end_user_authentication:
|
|
entity_id: ""
|
|
idp_name: ""
|
|
issuer_uri: ""
|
|
metadata: ""
|
|
metadata_url: ""
|
|
webhook_settings:
|
|
activities_webhook:
|
|
enable_activities_webhook: true
|
|
destination_url: https://activities_webhook_url
|
|
failing_policies_webhook:
|
|
destination_url: https://host.docker.internal:8080/bozo
|
|
enable_failing_policies_webhook: false
|
|
host_batch_size: 0
|
|
policy_ids: []
|
|
host_status_webhook:
|
|
days_count: 0
|
|
destination_url: ""
|
|
enable_host_status_webhook: false
|
|
host_percentage: 0
|
|
interval: 24h0m0s
|
|
vulnerabilities_webhook:
|
|
destination_url: ""
|
|
enable_vulnerabilities_webhook: false
|
|
host_batch_size: 0
|
|
fleet_desktop: # Applies to Fleet Premium only
|
|
transparency_url: https://fleetdm.com/transparency
|
|
host_expiry_settings: # Applies to all teams
|
|
host_expiry_enabled: false
|
|
activity_expiry_settings:
|
|
activity_expiry_enabled: true
|
|
activity_expiry_window: 60
|
|
features: # Features added to all teams
|
|
enable_host_users: true
|
|
enable_software_inventory: true
|
|
vulnerability_settings:
|
|
databases_path: ""
|
|
secrets: # These secrets are used to enroll hosts to the "All teams" team
|
|
- secret: SampleSecret123
|
|
- secret: ABC
|
|
software:
|
|
packages:
|
|
- url: https://example.com/pkg.deb
|
|
version: "1.2.3"
|
|
app_store_apps:
|
|
- app_store_id: "1234567"
|
|
fleet_maintained_apps:
|
|
- slug: firefox/darwin
|